On Tue, 17 Jul 2018, John Hardin wrote:
On Tue, 18 Jul 2018, Chip M. wrote:
Here's the SA test stats for 13 of this new morph:
FORGED_MUA_MOZILLA 1
HTML_MESSAGE 13
HTML_MIME_NO_HTML_TAG 13
LOCALPART_IN_SUBJECT 13
MIME_BASE64_TEXT 9
MIME_HTML_ONLY 13
RCVD_IN_SORBS_DUL 1
RDNS_DYNAMIC 3
TVD_RCVD_SPACE_BRACKET 6
UNPARSEABLE_RELAY 6
This new variant should be easy to exterminate. :)
1. The quick and easy combo of "HTML_MIME_NO_HTML_TAG" and
"LOCALPART_IN_SUBJECT" is worth a meta.
The latter test is _VERY_ rare in Ham.
Not according to masscheck.
overlap ham: 48% of LOCALPART_IN_SUBJECT hits also hit
HTML_MIME_NO_HTML_TAG; 0% of HTML_MIME_NO_HTML_TAG hits also hit
LOCALPART_IN_SUBJECT (spam 3%)
No spam overlap at all. Masscheck would not promote that.
Sorry - 3% spam overlap, which isn't good enough to report in the
"spam overlap" section explicitly.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
If the rock of doom requires a gentle nudge away from Gaia to
prevent a very bad day for Earthlings, NASA won’t be riding to the
rescue. These days, NASA does dodgy weather research and outreach
programs, not stuff in actual space with rockets piloted by
flinty-eyed men called Buzz. -- Daily Bayonet
-----------------------------------------------------------------------
3 days until the 49th anniversary of Apollo 11 landing on the Moon
